Proofing

Signed-off-by: apostasie <spam_blackhole@farcloser.world>

Author: apostasie

.github/workflows/lint.yml

@@ -77,4 +77,4 @@ jobs:
       timeout: 5
       go-version: ${{ matrix.go-version }}
       runner: ubuntu-24.04
-      canary: ${{ matrix.canary && true || false }}
+      canary: ${{ matrix.canary && true || false }}

.github/workflows/test-canary.yml

@@ -0,0 +1,71 @@
+name: proofing
+
+on:
+  push:
+    branches:
+      - main
+      - 'release/**'
+  pull_request:
+
+env:
+  GOTOOLCHAIN: local
+
+jobs:
+  proofing:
+    name: "proofing"
+    timeout-minutes: 15
+    runs-on: ubuntu-24.04
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: "Checkout project"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+
+      - name: "Install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        with:
+          go-version: 1.24
+          check-latest: true
+
+      - name: setup
+        run: |
+          set -x
+
+          CLI=docker ./mod/proofing/spoof.sh server::start ./pkg/testutil/images.env
+
+          # Check the server is reachable
+          curl -iv https://proofing:443/v2 || true
+
+          # Restart services so they catch-up on the system store changes?
+          sudo systemctl stop containerd || true
+          sudo systemctl start containerd || true
+          systemctl --user stop containerd || true
+          systemctl --user start containerd || true
+          sudo systemctl stop docker || true
+          sudo systemctl start docker || true
+
+          make binaries
+          sudo -E PATH="_output:$PATH" nerdctl pull debian
+          sudo -E PATH="_output:$PATH" nerdctl tag debian proofing:443/debian || true
+          sudo -E PATH="_output:$PATH" nerdctl --insecure-registry push proofing:443/debian || true
+          sudo -E PATH="_output:$PATH" nerdctl push proofing:443/debian || true
+
+          PATH="_output:$PATH" nerdctl pull debian
+          PATH="_output:$PATH" nerdctl tag debian proofing:443/debian || true
+          PATH="_output:$PATH" nerdctl --insecure-registry push proofing:443/debian || true
+          PATH="_output:$PATH" nerdctl push proofing:443/debian || true
+
+#            sudo -E PATH="_output:$PATH" ./mod/proofing/spoof.sh server::seed ./pkg/testutil/images.env
+      - name: test in container
+        run: |
+          set -x
+
+          docker run -ti debian bash -c -- '
+            ip="$(cat /etc/hosts | grep proofing | awk '{print $1}')"
+            ./mod/proofing/spoof.sh guest::configure ./pkg/testutil/images.env "$ip"
+            curl -iv "https://docker.io/v2"
+            curl -iv "https://proofing/v2"
+          '